Security issue fix for /static-files/{path} endpoint

[mihran113]

Fix security issue when incorrect path is given to the endpoint that serves static files which can lead to a leak of files (e.g. /static-files/../../../../etc/passwd)

[mihran113]

resolves #999

[haby0]

If you use os.path.join(static_file_root, path) to join the path, the path parameter value cannot have / or \\, Otherwise, the request will definitely make the result of if judgment as True.

[mihran113]

If you use os.path.join(static_file_root, path) to join the path, the path parameter value cannot have / or \\, Otherwise, the request will definitely make the result of if judgment as True.

I think you meant that if the path starts with / or \\ then os.path.join won't work as expected. Yeah, that's a valid concern, but our UI handles that. Anyways will change that with usual join to avoid any failures. Thanks for the comment.